CLAIMS 
We claim: 



1 1. A computer implemented method comprising: 

2 determining a set of endpoints for a generic routing encapsulation (GRE) tunnel; 

3 determining a key, the key corresponding to a virtual private network (VPN); 

4 dynamically establishing the GRE tunnel with the set of endpoints and the key; 

5 and 

6 processing a set of GRE traffic for the VPN. 

l 2. The computer implemented method of claim 1 wherein the set of points comprise 



2 a first value indicating a first virtual router, the first virtual router corresponding to the 

3 VPN, a second value indicating a second virtual router, a third value indicating a third 

4 virtual router, the second and third virtual routers corresponding to a backbone, and a 

5 fourth value indicating a fourth virtual router, the fourth virtual router corresponding to 

6 the VPN. 



1 3. The computer implemented method of claim 1 wherein dynamically establishing 

2 the GRE tunnel comprises: 

3 establishing a first subset of the set of endpoints for entering and exiting the VPN; 

4 and 

5 establishing an initiation point and a termination point for the GRE tunnel with a 

6 second subset of the set of endpoints. 
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1 4. A computer implemented method comprising: 

2 determining a first set of endpoints for a generic routing encapsulation (GRE) 

3 tunnel; 

4 determining a key, the key corresponding to a virtual private network (VPN); 

5 using the key and the set of endpoints to determine a second set of endpoints for 

6 the VPN; 

7 establishing the GRE tunnel with the set of attributes; and 

8 processing a set of traffic for the VPN. 

1 5. The computer implemented method of claim 4 wherein the first set of endpoints 

2 comprise a first value indicating a first virtual router, the first virtual router being an 

3 initiation point of the GRE tunnel, and a second value indicating a second virtual router, 

4 the second virtual router being a termination point for the GRE tunnel. 

1 6. The computer implemented method of claim 4 wherein the second set of 

2 endpoints comprise a first value indicating a first virtual router corresponding to the VPN, 

3 and a second value indicating a second virtual router, the second virtual router 

4 corresponding to the VPN. 

1 7. The computer implemented method of claim 4 wherein the second set of 

2 endpoints and the set of attributes are each indexed by the key and the first set of 

3 endpoints. 
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8. 



A system comprising: 



4 



6 



2 



3 



5 



a first network element to determine a key and a first set of endpoints for a generic 
routing encapsulation (GRE) tunnel, the key corresponding to a virtual 
private network (VPN), to determine a second set of endpoints for the 
GRE VPN, to configure an initiation point of the GRE tunnel, to transmit a 
packet having the first set of end points and the key; and 



9 



7 



8 



a second network element coupled with the first network element, the second 
network element to receive the packet, to determine the second set of 
endpoints for the GRE VPN, and to establish the GRE tunnel. 



1 9. The system of claim 8 further comprising a third network element, the third 

2 network element coupled with the first and the second network element, the third network 

3 element to receive a set of data from the first network element and forward the set of data 

4 to the second network element, the set of data being for the VPN. 

1 10. The system of claim 8 wherein the second set of endpoints are indexed by the first 

2 set of endpoints and the key. 

1 11. The system of claim 8 wherein to configure the initiation point comprises to 

2 configure one of the second set of endpoints to one of the first set of endpoints. 
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12. An apparatus comprising: 



4 



5 



3 



2 



a control engine to retrieve a first set of endpoints corresponding to a generic 

routing encapsulation (GRE) tunnel, to retrieve a second set of endpoints 
corresponding to the first set of endpoints and a key, the key 
corresponding to a virtual private network (VPN); and 



7 



6 



a forwarding engine coupled with the control engine, the forwarding engine to 
establish an initiation point of the GRE tunnel and to transmit a set of 



8 



traffic over the GRE VPN. 



1 13. The apparatus of claim 1 1 wherein the forwarding engine to host a first and 

2 second virtual router, the first virtual router corresponding to one of the first set of 

3 endpoints and the second virtual router corresponding to one of the second set of 

4 endpoints. 

1 14. The apparatus of claim 1 1 wherein the second set of endpoints are indexed by the 

2 key and the first set of endpoints. 
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1 15. An apparatus comprising: 

2 an input/output module to receive a set of data, the set of data indicating a key and 

3 a first of set of endpoints of a generic routing encapsulation GRE tunnel, 

4 the key corresponding to a virtual private network (VPN); and 

5 a control engine coupled with the input/output module, the control engine to 

6 determine a second set of endpoints for the VPN with the key and the first 

7 set of endpoints; and 

8 a forwarding engine coupled with the control engine and the input/output module, 

9 the forwarding engine to dynamically establish the GRE tunnel with the 

10 first set of endpoints and the second set of endpoints and to process a set of 

11 traffic for the VPN. 

1 16. The apparatus of claim 1 5 wherein the second set of endpoints are indexed by the 

2 key and the first set of endpoints. 

1 17. The apparatus of claim 15 wherein to establish the GRE tunnel comprises: 

2 to configure one of the second set of endpoints to one of the first set of endpoints; 

3 and 

4 to indicate the key in a list of keys. 
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12 



18. A machine-readable medium that provides instructions, which when executed by a 
set of one or more processors, cause said set of processors to perform operations 
comprising: 

retrieving a first set of endpoints of a generic routing encapsulation (GRE) tunnel 
with a generic routing encapsulation (GRE) tunnel name; 

determining a second set of endpoints with the first set of endpoints and a key, the 
key corresponding to a virtual private network (VPN); 

establishing an initiation point of the GRE tunnel with the first set of endpoints 
and the second set of endpoints; 

transmitting the first set of endpoints and the key; and 

transmitting a set of traffic over the GRE VPN. 

1 9. The machine-readable medium of claim 1 8 wherein the establishing the initiation 
point of the GRE tunnel comprises configuring one of the second set of endpoints to one 
of the first set of endpoints. 

20. The machine-readable medium of claim 1 8 further comprising: 
receiving a second set of traffic for a second VPN, the second set of traffic 

indicating the GRE tunnel; 
determining a third set of endpoints with a second key and the first set of 

endpoints, the second key corresponding to the second VPN; 
configuring one of the third set of endpoints to one of the first set of endpoints; 
transmitting the second key and the first set of endpoints; and 
transmitting the second set of traffic. 
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1 21 . A machine-readable medium that provides instructions, which when executed by a 

2 set of one or more processors, cause said set of processors to perform operations 

3 comprising: 

4 listening for a packet, the packet indicating a first set of endpoints for a generic 

5 routing encapsulation (GRE) tunnel and a key, the key corresponding to a 

6 virtual private network (VPN); 

7 receiving the packet; 

8 retrieving a second set of endpoints for the VPN with the first set of endpoints and 

9 the key; 

10 establishing the GRE tunnel with the first set of endpoints and the second set of 

11 endpoints; and 

12 processing a set of traffic over the GRE VPN. 

1 22. The machine-readable medium of claim 21 wherein establishing the GRE tunnel 

2 comprises: 

3 configuring one of the second set of endpoints to one of the first set of endpoints; 

4 and 

5 maintaining the key in a list of keys. 

1 23. The machine-readable medium of claim 21 further comprising: 

2 receiving a second packet, the second packet indicating the first set of endpoints 

3 and a second key, the second key corresponding to a second VPN; 

4 retrieving a third set of endpoints with the second key and the first set of 

5 endpoints; 

6 receiving a second set of traffic; and 

7 forwarding the second set of traffic to one of the third set of endpoints. 

1 24. The machine-readable medium of claim 21 further comprising: 

2 receiving a second packet, the second packet indicating a second key; 

3 determining that the second key is not in a key list; and 

4 ensuring that the second packet originated from an interior source. 
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